This is an English translation of the Korean original. If they differ, the Korean text governs.
Privacy Policy
A.PEN Co., Ltd. lawfully processes and securely manages personal data in compliance with the Personal Information Protection Act and related laws to protect the freedoms and rights of data subjects. Under Article 30 of that Act, we establish and publish this policy to explain processing and protection procedures and standards and handle related complaints promptly and smoothly.
1. Purposes, data items, processing, and retention periods
We collect and use only the minimum personal data necessary to provide the Services under the Personal Information Protection Act.
1) Personal data processed without consent
We process the following data without the data subject's consent.
Swipe the table to see all columns.
| Legal basis | Category | Purpose | Data items | Retention and use period |
|---|---|---|---|---|
| Personal Information Protection Act, Article 15(1)(4) (contract performance) | Member services | Confirm intention to register; identify and authenticate members; maintain and manage login sessions and membership; deliver service notices and notifications; check whether under 14 | Member identifier; whether under 14; Naver sign-in: Naver email and user identifier; Google sign-in: Google email and Firebase UID; Apple sign-in: Apple email | Until account deletion |
| Same contract-performance basis | Orders and payments | Credit purchases, orders, and payment processing | Member identifier; order/payment identifiers; buyer details actually supplied (name, mobile number, email); payment details (product name, method, amount, currency, approval, cancellation, refund) | Until account deletion; legally required transaction records are retained for the periods below under Article 15(1)(2) |
| Same contract-performance basis | Customer inquiries | Handle errors, difficulties, and inquiries | Member identifier; error, difficulty, or inquiry details; purchase/cancellation/exchange/refund information | Until account deletion; legally required transaction records are retained for the periods below under Article 15(1)(2) |
| Same contract-performance basis | Author services | Operate writing and publishing services; provide creative support (episode-text image conversion, representative phrase suggestions, etc.); diagnose errors and improve these features | Member identifier; author name and introduction; avatar settings; work title; genre; episode text; creative-support request/result history | Until account deletion |
| Same contract-performance basis | Contests | Operate contests | Member identifier; email; contest submission information | Until account deletion |
| Same contract-performance basis | Reading services | Operate access to authors' works | Member identifier; comments; episode reactions; bookmarks; work/episode viewing information; notification read/archive state | Until account deletion |
| Same contract-performance basis | Personalized recommendations and usage analysis | Analyze reading/viewing history, counts, time spent, and usage records to provide similar/recommended works, personalized home/list screens, and continue reading; diagnose errors and improve existing features and content | Member identifier; online identifier (Mixpanel distinct_id); work/episode viewing and reading history (episode, time, duration); page visits/use (title, URL/path/search parameters, referrer, time); search history; browser/OS/device/screen information; IP address and approximate IP-based location | Until account deletion |
| Personal Information Protection Act, Article 15(1)(6) (legitimate interests) | Abuse prevention | Prevent misuse of the Services | Member identifier; one-way hashes of email and social-login identifiers; purchase/cancellation/exchange/refund information | Until 6 months after account deletion |
| Personal Information Protection Act, Article 15(1)(2) (specific statutory provisions) | Communications records | Retain computer communications, internet logs, and service visit records | Computer communications and internet logs; connection-location tracing data | 3 months (Protection of Communications Secrets Act, Article 15-2; Enforcement Decree, Article 41(2)(2)) |
| Act on Consumer Protection in Electronic Commerce, Article 6; Enforcement Decree, Article 6(1) | Transaction records | Retain advertising, contracts/withdrawals, payments/supply, and consumer complaints/disputes | Member identifier; advertising records; contract/withdrawal records; payment/content supply records; consumer complaint/dispute records | Advertising: 6 months; contracts/withdrawals: 5 years; payments/supply: 5 years; complaints/disputes: 3 years |
| Framework Act on National Taxes, Article 85-3 | Books and evidence | Retain books and evidence for national tax assessment and collection | Transaction date, amount, payment method, and other transaction evidence | 5 years after the statutory filing deadline for the relevant national tax |
| Value-Added Tax Act, Article 71 | Preparation and retention of books | Retain books and tax invoices for VAT reporting and payment | Supply value, tax amount, transaction date, and other transaction evidence | 5 years after the final return deadline for the relevant tax period |
| Personal Information Protection Act, Article 15(1)(6) (legitimate interests) | Dispute resolution | Collect and manage material for disputes | Errors, difficulties, inquiries; consent/account-deletion confirmation evidence; purchase/cancellation/exchange/refund information | Until 2 years after account deletion |
2) Personal data processed with consent
We process the following data with the data subject's consent.
Swipe the table to see all columns.
| Legal basis | Category | Purpose | Data items | Retention and use period |
|---|---|---|---|---|
| Personal Information Protection Act, Article 15(1)(1) (consent) | Events | Accept event entries and draw prizes | Email address | Until 6 months after the event ends |
| Personal Information Protection Act, Article 22(1)(7) (promotion) | Promotion and marketing | Promote the service and announce events and promotions | Email address, order history | Until 6 months after consent withdrawal or account deletion |
2. Personal data of children under 14
- We restrict registration by children under 14 and do not process their personal data.
3. Destruction procedures and methods
- We destroy personal data without delay when no longer necessary, including when its retention period expires or its purpose is achieved.
- If another law requires continued retention after expiry or purpose completion, the data is moved to a separate database or storage location. Section 1 lists the data retained after account deletion or consent withdrawal and the basis for retention.
- Data pseudonymized under Article 28-2 of the Personal Information Protection Act is destroyed when the period in section 8 expires or the purpose is achieved.
- Destruction procedures and methods are as follows.
- Procedure: We select data whose destruction grounds have arisen and destroy it with approval from our privacy officer.
- Method: Electronic files are destroyed so they cannot be restored; paper records are shredded or incinerated.
- On account deletion:
- We end account use and public availability of works. We destroy general member emails and social identifiers, author names/introduction/avatars, bookmarks, likes, individual viewing histories, push tokens, general notifications, and creative-support usage records. Comment text is erased, retaining only the minimum indication needed to connect replies.
- We remove authors' current manuscripts and publicly displayed text. Published-edition copies and publication history needed for purchasers' access rights and transaction evidence are retained.
- Abuse-prevention member identifiers and one-way email/social-identifier hashes are separated from general member information, retained for 6 months after deletion, then destroyed. Consent and confirmation evidence is retained separately for 2 years for rights requests and disputes. Actual disputes or additional statutory retention duties are managed with separate reasons and end dates.
- Account deletion alone does not extinguish remaining paid C or statutory refund rights. We retain balance ledgers, orders, payments, refunds, purchase documents, and minimum identifiers needed for purchaser access. Transaction retention follows section 1. Re-registration creates a new account without automatically transferring old balances or purchases. Refunds may still be requested from the store or customer support using original payment evidence.
- We request deletion of the Firebase Authentication account and Mixpanel data linked to the member identifier. Minimum identifiers needed for provider deletion are retained separately solely for that process and erased after provider completion is confirmed. Receipt of a deletion request is distinguished from actual provider completion.
4. Disclosure to third parties
- We currently do not provide personal data to third parties.
- We may provide the following data to relevant authorities without consent.
Swipe the table to see all columns.
| Legal basis | Recipient | Recipient purpose | Data provided |
|---|---|---|---|
| Personal Information Protection Act, Article 18(2)(2) (specific statutory provisions); Criminal Procedure Act, Article 215 | Competent police or prosecutors' office | Requests under a seizure, search, or inspection warrant | Information within the requested scope |
- Under the jointly issued government Guidelines for Personal Data Processing and Protection in Emergencies, we may provide data without consent in emergencies including disasters, infectious disease, imminent threats to life or physical safety, or imminent property loss. See the government guidance for details.
In those cases, only the legally necessary minimum data is provided, and not for other purposes.
5. Entrusted processing
- We entrust the following tasks to support personal data operations.
Swipe the table to see all columns.
| Processor | Entrusted tasks |
|---|---|
| Korea PortOne Co., Ltd. | Relay payment requests and link approvals; query/notify payment results; support cancellation, refunds, and reconciliation |
| Apple Inc. | APNs notifications; App Store in-app payment processing and cancellation/refunds |
| Google LLC | FCM notifications; processing/storage of app/web usage analysis (Google Analytics for Firebase); Google Play in-app payments and cancellation/refunds |
| Amazon Web Services, Inc. | Storage of data including personal data (domestic region) |
| Mixpanel, Inc. | Processing/storage of analytics data for usage analysis and personalized recommendations |
- Under Article 26 of the Personal Information Protection Act, written entrustment contracts specify prohibition of processing beyond entrusted purposes, technical/administrative protection, restrictions on subprocessing, supervision, and liability including damages. We supervise safe processing.
- Under Article 26(6), processors obtain our consent before subprocessing. We disclose subprocessors and their tasks through this policy.
- Changes to entrusted tasks or processors are disclosed here without delay.
- Overseas entrustment is described in section 6.
6. Overseas collection and transfers
We entrust processing to overseas businesses as necessary to perform our service contract with data subjects. Under Article 28-8(1)(3) of the Personal Information Protection Act, this policy discloses the items in paragraph 2 of that article; separate consent is therefore not obtained for the transfers below.
① Mixpanel, Inc. (analytics and personalized recommendations)
Swipe the table to see all columns.
| Legal basis | Item | Details |
|---|---|---|
| Personal Information Protection Act, Article 26 (entrustment), Article 28-8(1)(3) (entrustment/storage for contract formation/performance) | Transferred/entrusted data | Member identifier; online identifier (Mixpanel distinct_id); work/episode viewing and reading history (episode, time, duration); page visits/use (title, URL/path/search parameters, referrer, time); browser/OS/device/screen information; IP address and approximate IP-based location |
| Same basis | Country | United States |
| Same basis | Timing and method | In real time when using website/app screens, through the JavaScript SDK and server integration over encrypted HTTPS |
| Same basis | Recipient/processor | Mixpanel, Inc. (privacy inquiries: compliance@mixpanel.com) |
| Same basis | Purpose | Similar/recommended works and personalized screens based on usage analysis; error diagnosis and feature/content quality improvement through usage-flow analysis |
| Same basis | Retention and use | During the Mixpanel service contract; deleted on our request or within 90 days after termination/expiry. On account deletion, we request deletion of transferred member data without delay. Statutorily required retention continues for that period. |
| Same basis | Refusal procedure and effect | Request cessation of analytics/recommendation transfers in Settings > Privacy controls, or delete the account. Similar/recommended works, continue reading, and other personalized functions become unavailable; basic services such as reading and payments remain available. |
② Google LLC (notifications and app/web analytics)
Swipe the table to see all columns.
| Legal basis | Item | Details |
|---|---|---|
| Personal Information Protection Act, Article 26 (entrustment), Article 28-8(1)(3) (entrustment/storage for contract formation/performance) | Transferred/entrusted data | Device push token (FCM registration token); online identifiers (app instance ID, client ID, etc.); page/screen visits and usage (screen name, page URL/title, session/usage time); browser/OS/device/screen resolution/language; IP address and approximate IP-based location; notification content |
| Same basis | Country | United States |
| Same basis | Timing and method | In real time when launching/using the app or website and when we send notifications, through SDKs/APIs over encrypted HTTPS |
| Same basis | Recipient/processor | Google LLC (privacy inquiries: https://support.google.com/policies) |
| Same basis | Purpose | FCM push notifications; app/web usage statistics and service quality improvement |
| Same basis | Retention and use | During the Google service contract; deleted when the console-configured retention period (up to 14 months) expires, on our deletion request, or on contract termination. Statutorily required retention continues for that period. |
| Same basis | Refusal procedure and effect | Refuse notifications in device settings or delete the account. Relevant features, including push notifications, become unavailable. |
③ Apple Inc. (notifications)
Swipe the table to see all columns.
| Legal basis | Item | Details |
|---|---|---|
| Personal Information Protection Act, Article 26 (entrustment), Article 28-8(1)(3) (entrustment/storage for contract formation/performance) | Transferred/entrusted data | Device push token (APNs device token); notification content |
| Same basis | Country | United States |
| Same basis | Timing and method | In real time when we send notifications, through APNs over encrypted HTTPS |
| Same basis | Recipient/processor | Apple Inc. (privacy inquiries: https://www.apple.com/legal/privacy/contact/) |
| Same basis | Purpose | Push notifications to iOS devices |
| Same basis | Retention and use | As necessary for notification delivery (until delivery completion or token expiry) |
| Same basis | Refusal procedure and effect | Refuse notifications in device settings or delete the account. Relevant features, including push notifications, become unavailable. |
7. Security measures
- We take the following measures to secure personal data.
- Administrative: establish and implement internal management plans, regularly train staff, and operate a dedicated organization.
- Technical: manage access rights to processing systems; install access controls and related safeguards; encrypt personal data; retain and inspect access logs; install, operate, and update security software; inspect and remedy system vulnerabilities.
- Physical: control access to computer and storage rooms; store documents and auxiliary media securely under lock; implement disaster safeguards; control movement of auxiliary storage media.
8. Pseudonymized data
- Under Article 28-2 of the Personal Information Protection Act, we pseudonymize collected data so specific individuals cannot be identified for statistics, scientific research, or public-interest archiving. Pseudonymized data is processed only in our domestic systems and is not transferred overseas.
Use of pseudonymized data
Swipe the table to see all columns.
| Type | Recipient | Purpose | Data items | Period |
|---|---|---|---|---|
| Internal use | — | Usage trend statistics; research, development, and performance validation of new recommendation algorithms (scientific research) | Research serial number replacing member identifier; work/episode reading history (work/episode identifiers, reading date); likes/bookmarks; episode reactions; access date; OS type; language setting | Until research/validation purpose is achieved, up to 1 year |
| Internal use | — | Research, development, and performance validation of new AI creative-support features (scientific research) | Research serial number replacing member identifier; AI feature usage (type, request date, volume); edits/adoption/regeneration of generated results; work metadata (genre, episode-count range, publication state); grouped reading/reaction aggregates | Until research/validation purpose is achieved, up to 1 year |
Safeguards under Article 28-4
- Administrative: internal management plans and regular staff training.
- Technical: separate pseudonymized data from additional identifying information; destroy additional information when unnecessary; separate access rights; install access controls; retain and inspect processing/access records; install security software.
- Physical: control access to rooms storing pseudonymized data.
9. Automatic collection technologies and refusal
Processing behavioral data that identifies data subjects
Technologies used
- We use cookies, which store and retrieve usage information, to provide individualized services and convenience.
- Cookies are small pieces of information sent by a website's HTTP server to a browser, stored on a computer or mobile device, and automatically returned to the server on visits.
- Data subjects can refuse cookies through browser settings.
- Desktop Chrome: top-right menu > New Incognito window (Ctrl+Shift+N).
- Desktop Edge: top-right menu > New InPrivate window (Ctrl+Shift+N).
- Mobile Chrome: top-right menu > New Incognito tab.
- Mobile Safari: device Settings > Safari > Advanced > Block All Cookies.
- Samsung Internet: bottom Tabs icon > Turn on Secret mode > Start.
Collection, use, provision, and refusal of behavioral data
- We use cookies and online identifiers to process identifiable behavioral data to recommend suitable works and improve Services and content. We do not provide personalized advertising.
- We collect behavioral data on our website as follows.
Swipe the table to see all columns.
| Legal basis | Data items | Method | Purpose | Retention and use |
|---|---|---|---|---|
| Personal Information Protection Act, Article 15(1)(4) (contract performance) | Page visits/use (title, URL/path, referrer, time, duration); work/episode viewing and reading history; online identifier (Mixpanel distinct_id); member identifier; browser/OS/device/screen information; IP address and approximate IP-based location | Automatically on website visits or app launch/use | Personalized recommendations including similar/recommended works; usage analysis; service/content quality improvement | Until account deletion |
- We collect only the minimum behavioral data needed for personalized recommendations and other Services. We do not collect sensitive behavioral data, such as ideology, beliefs, or medical history, that could infringe rights, interests, or privacy.
- For questions, refusal rights, or reports of harm concerning behavioral data, contact the department in section 12.
- You may request that behavioral processing for personalized recommendations and analytics stop through Settings > Privacy controls or Contact us. Similar/recommended works, continue reading, and other personalized functions then become unavailable; other Services remain available.
10. Third-party behavioral collection technologies and refusal
- When data subjects visit or use our website/app, we allow third parties to collect behavioral data through cookies and similar technologies to support Services, including video content. We do not provide personalized advertising or permit third-party behavioral collection for advertising purposes.
- Third parties collect the following through our website/app.
Swipe the table to see all columns.
| Technology | Type | Collecting business | Data items | Purpose |
|---|---|---|---|---|
| YouTube embedded player | iframe (web/app webview), cookies, and similar technologies | Google LLC (YouTube) | URL of the page displaying the embed; IP address; browser/OS/device information; cookies/online identifiers; playback/viewing information | Video provision/playback; usage statistics; abuse prevention; YouTube content/advertising personalization according to user settings |
- You can allow or block third-party behavioral collection through browser cookie settings.
- Chrome third-party cookies: Settings > Privacy and security > Third-party cookies > choose whether to block third-party cookies.
- Chrome private browsing: top-right menu > New Incognito window. Browsing history, cookies/site data, and form entries are not stored on the device in Incognito mode.
- Edge tracking prevention: top-right menu > Settings > Privacy controls, search, and services > Tracking prevention; choose whether to enable it and its level (Balanced or Strict).
- Edge third-party cookies: Settings > Cookies and site permissions > Manage and delete cookies and site data > Block third-party cookies.
- Edge private browsing: top-right menu > New InPrivate window. Browsing history, cookies/site data, and form entries are not stored on the device in InPrivate mode.
11. Rights of data subjects and legal representatives
- You may request access, transmission, correction, deletion, restriction of processing, and consent withdrawal at any time (“exercise of rights”).
- Under Article 41(1) of the Enforcement Decree of the Personal Information Protection Act, requests may be made in writing, by email, fax, internet, or similar means. We act without delay.
- You may directly view, edit, delete, restrict processing, or withdraw consent through the website or the app (Settings > Privacy controls), or request access through Contact us.
- A legal representative or authorized agent may exercise rights. Submit a power of attorney using Form 11 attached to the Notice on Personal Data Processing Methods.
- Access and processing-restriction rights may be limited under Articles 35(4) and 37(2) of the Personal Information Protection Act.
- Deletion cannot be requested where another law expressly requires collection of the data.
- We verify that the requester is the data subject or a legitimate representative.
- Requests may be made to the department in section 12. We respond within 10 days after receiving a request, or without delay for transmission requests.
12. Privacy officer and responsible department
- We designate the following privacy officer to oversee processing and handle complaints and relief concerning personal data.
Swipe the table to see all columns.
| Role | Name/department | Contact |
|---|---|---|
| Privacy officer | Seohyun Ko, Representative | Email: contact@oneminutego.com; Phone: 070-8822-1110 |
| Privacy department and access requests | Customer Support Team | Email: contact@oneminutego.com; Phone: 070-8822-1110 |
- For any privacy inquiries, complaints, or relief arising from our Services or business, contact the officer or department. We respond and act without delay.
13. Remedies for rights infringement
- You may seek mediation or consultation from the Personal Information Dispute Mediation Committee or the Korea Internet & Security Agency's Personal Information Infringement Report Center. You may also contact:
- Personal Information Dispute Mediation Committee: 1833-6972 (no area code within Korea), www.kopico.go.kr.
- Personal Information Infringement Report Center: 118 (no area code within Korea), privacy.kisa.or.kr.
- National Police Agency: 182 (no area code within Korea), ecrm.cyber.go.kr.
- We endeavor to protect informational self-determination and provide consultation and relief for infringements. For reports or consultation, contact the department in section 12.
14. Changes to this policy
- This policy applies from October 12, 2026.
- Previous policies (Korean originals):